mediumMultiple ChoiceObjective-mapped
MS-102 Practice Question: A company has a hybrid identity with password…
A company has a hybrid identity with password hash synchronization. They want to ensure that any user whose account is disabled in on-premises Active Directory is automatically prevented from signing in to Microsoft 365. How can this be achieved?
⚠ Common exam trap
The trap here is that candidates may overthink the solution and assume additional configuration or scripting is required, when in fact Entra Connect automatically synchronizes the disabled status as part of its default attribute mapping.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure Microsoft Entra Connect is configured to synchronize the disabled status; this happens automatically.
Microsoft Entra Connect (formerly Azure AD Connect) by default synchronizes the `userAccountControl` attribute from on-premises Active Directory, which includes the disabled status (bit 2, ACCOUNTDISABLE). When an on-premises user account is disabled, the corresponding `accountEnabled` attribute in Microsoft Entra ID is set to `false`, preventing sign-in to Microsoft 365 without additional configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ensure Microsoft Entra Connect is configured to synchronize the disabled status; this happens automatically.
Why this is correct
Microsoft Entra Connect's default synchronization rules automatically map the on-premises Active Directory userAccountControl disabled bit to the accountEnabled attribute in Entra ID. When you disable an on-premises user, the next delta sync changes the cloud account's accountEnabled to false, which immediately prevents that user from obtaining tokens. No additional configuration is required, and password hash synchronization remains unaffected because status and password are separate attributes.
- ✗
Create a dynamic group based on accountEnabled attribute and apply a Conditional Access policy to block access.
Why it's wrong here
A dynamic group based on accountEnabled can be created and targeted by a Conditional Access policy, but this is a redundant control that adds dependency on group membership evaluation and policy scope. Disabled synced accounts are already blocked at the authentication level, so CA adds no security value; it may also leave a window where a recently disabled user can still access resources until group membership recalculates and CA policy applies. The proper and simpler fix is to let the directory sync set accountEnabled to false.
- ✗
Run a PowerShell script daily to disable matching accounts in Microsoft Entra ID.
Why it's wrong here
Running a PowerShell script daily to disable matching cloud accounts is an anti-pattern because Microsoft Entra Connect already propagates the on-premises disabled status automatically. A custom script introduces potential failure points such as missed users, connector account permissions, throttling, and race conditions with sync cycles, and it would bypass the sync engine's conflict resolution. It also duplicates management effort and can cause inconsistent state if the script runs before the on-premises change is synchronized.
- ✗
Enable cloud HR provisioning.
Why it's wrong here
Cloud HR provisioning is designed for HR-driven lifecycle scenarios such as Workday or SAP SuccessFactors creating new worker accounts, not for reflecting the disabled status of existing on-premises AD users. Enabling it would shift provisioning authority to the HR system and could overwrite or out-of-band manage user attributes that are already governed by Entra Connect from on-premises AD. It does not address the requirement of syncing a local account's disabled bit, so it is the wrong solution here.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Hybrid identity
Hybrid identity is an approach that synchronizes and manages user identities across both on-premises directories and cloud-based services, allowing seamless access to resources in both environments.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.